{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:a6bd62a3-1818-50c7-974e-2e44f4333ac7",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "undertow-core",
      "purl": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1",
      "type": "library",
      "group": "io.undertow",
      "bom-ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1",
      "version": "2.2.28.Final-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "undertow-core",
            "purl": "pkg:maven/io.undertow/undertow-core@2.2.28.Final",
            "type": "library",
            "group": "io.undertow",
            "version": "2.2.28.Final"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2014-7816",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:01056390-13b7-53bb-8691-d3468fe72929",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2014-7816 does not affect version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core. not_affected \u2014 CVE-2014-7816 is not present in Undertow 2.2.28.Final. The directory traversal vulnerability affecting Windows systems (allowing backslash characters in URIs to bypass path canonicalization) was fixed by upstream commit 28f244e63f558ba99a197813cfd5eee461b52b4c (UNDERTOW-338) authored by Stuart Douglas on 2014-10-28. This fix was included in the upstream 2.2.28.Final release before TuxCare onboa...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-7046",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0bc6f8c9-4565-5118-b254-6e7e4a087ca5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-7046 does not affect version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core. not_affected \u2014 CVE-2016-7046 is not present in this target. The vulnerability (BufferOverflowException when handling long URLs) was fixed by upstream commit c518b5a1 in September 2016, which shipped in the upstream Undertow 2.2.28.Final release. The target contains the complete fix: length checking before writing request lines to buffers, incremental STATE_URL handling in HttpRequestConduit, overflow bufferin...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-12165",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:cc7ee0ac-0f21-54ae-b567-ad1492ca4547",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-12165 does not affect version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-12165 is not present in Undertow 2.2.28.Final. The fix was already included in the upstream release 2.2.28.Final before TuxCare onboarded it. Commit 1e72647818c9fb31b693a953b1ae595a6c82eb7f (authored by Stuart Douglas, an upstream Undertow developer) introduced comprehensive HTTP request validation to prevent request smuggling via unusual whitespace and invalid characters in headers. T...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-12196",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:46b72187-a59c-52a6-aa23-5c6a8bcd84f6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-12196 does not affect version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-12196 is not present in Undertow 2.2.28.Final. The vulnerability (missing URI validation in Digest authentication enabling MITM attacks) was fixed in upstream commits facb33a5c and 8804170ce by Stuart Douglas in Oct-Dec 2017, included in release 2.0.2.Final. The target version 2.2.28.Final is a later release that already contains these upstream fixes. The DigestAuthenticationMechanism....",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-2666",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:14195d4c-9f8b-5a95-a1b0-8af4bb310521",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-2666 does not affect version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-2666 is NOT present in Undertow 2.2.28.Final. The vulnerability (HTTP request smuggling via invalid characters in request line/headers) was fixed by upstream commits 1e72647818c (JBEAP-9909, 2017-03-30) and 3436b03eda8 (UNDERTOW-1165, 2017-08-04), both authored by Stuart Douglas. All five defense mechanisms from the vendor patches are present and active in the target: (1) ALLOWED_TOKEN...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-2670",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1529e71b-f868-5a66-9fc8-8d4d9541be9a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-2670 does not affect version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core. CVE-2017-2670 affects Undertow before version 1.3.28, causing infinite loops on IO threads when WebSocket connections experience non-clean TCP closes. The target version 2.2.28.Final already contains the upstream fix (commit 9bfe9fbbb) which adds STATE_STREAM_BROKEN to the listener loop termination condition. This fix was shipped in the upstream 2.2.28.Final release before TuxCare onboarding, so the vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.3.28), NVD (< 1.3.28), cve.org (= 1.3.28.Final-redhat-4), Snyk (< 2.0.0.Beta1).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-7559",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:add00ae8-24f7-546f-9d36-4fa9fcfca8f5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-7559 does not affect version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-7559 is NOT present in Undertow 2.2.28.Final. The vulnerability affected versions before 2.0.0.Alpha2 (circa 2017-2018), where invalid characters in query strings and path parameters were not properly validated. The target version includes the upstream fix (UNDERTOW-1165 from March 2017 and UNDERTOW-1185 from November 2017) that validates all characters in paths, query strings, and pat...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1114",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:40c9fd5a-f358-5446-aa86-4c795dc32aa8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1114 does not affect version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core. not_affected \u2014 The target is not affected by CVE-2018-1114. The file descriptor leak vulnerability in URLResource.getLastModified() for JAR protocol URLs was fixed in upstream commit 882d5884f (UNDERTOW-1338), which was already present in the upstream release 2.2.28.Final before TuxCare onboarded it. The fix prevents file descriptor exhaustion by avoiding JarURLConnection.getLastModified() calls and instead u...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-14642",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c066c4d9-f173-5153-9ae2-6f1b879d3842",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-14642 does not affect version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core. not_affected \u2014 CVE-2018-14642 (UNDERTOW-1412) is NOT present in the target. The vulnerability was an information leak where HttpResponseConduit.processWrite() wrote data.length bytes instead of length+1 bytes, potentially exposing stale buffer contents from previous requests. The fix (commit a83b047d5) changed line 157 from `res = next.write(data, 0, data.length)` to `res = next.write(data, 0, length + 1)`, l...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-10212",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2a2c9670-2df1-5f56-9719-24e9cbf99620",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-10212 does not affect version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core. Target Undertow 2.2.28.Final is NOT affected by CVE-2019-10212. Both vulnerability patterns (Basic Auth credentials in debug logs and Authorization headers in exchange.toString()) were fixed by upstream commits 8b63e258502f and 20cacc96c05 that shipped in the upstream release before TuxCare onboarding. The vulnerable logging code is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.20), NVD (< 2.0.20), cve.org (= 2.0.20), Snyk (< 2.0.21.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-14888",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9e9354a8-c0f1-5200-84cf-ad211e75a374",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-14888 does not affect version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core. Version 2.2.28.Final is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-vjxc-frw4-jmh5 (affected below 2.0.29.Final), NVD (affected up to 2.0.28), CVE record (affected below 2.0.28.SP1), Snyk (affected below 2.0.29.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-3888",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:86fc8231-ca97-5dec-b6ba-75603f5741ad",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-3888 does not affect version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core. CVE-2019-3888 affects Undertow versions before 2.0.21 due to plaintext credential exposure in log files. The target repository is version 2.2.28.Final, which already contains both upstream fixes: (1) HttpServerExchange.toString() no longer includes request/response headers (commit 20cacc96c, March 2019), and (2) BasicAuthenticationMechanism no longer logs plaintext credentials at DEBUG level (commit 8b63e2585, October 2019). Both fixes were present in the upstream 2.2.28.Final release when TuxCare onboarded it in September 2026. The vulnerable code patterns that would expose credentials in logs are not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.21), NVD (< 2.0.21), cve.org (= 2.0.21), Snyk (< 2.0.20.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-10687",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:97ad715b-1b47-5ae1-a12a-a40e928efafc",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-10687 does not affect version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core. not_affected \u2014 CVE-2020-10687 is not present in target version 2.2.28.Final. All three fix components addressing HTTP request smuggling (HTTP/2 pseudo-header validation UNDERTOW-1780, HTTP/1.x request target character validation UNDERTOW-1165, and header field-name whitespace rejection UNDERTOW-1774) were already included in the upstream Undertow 2.2.28.Final release. The fixes are upstream Red Hat work autho...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-10705",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d0e907d8-067c-5675-8f15-c0c87656cdbf",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-10705 does not affect version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core. CVE-2020-10705 affects Undertow versions before 2.1.1.Final due to buffer leaks when handling \"Expect: 100-continue\" requests, potentially leading to out-of-memory denial of service. The target version 2.2.28.Final is NOT affected because all three upstream fix commits (64bbaeb7c, aa5e1fe11, b53d4589c) were already present in the upstream release before TuxCare onboarded. The fixes include: buffer cleanup via freeContinueResponse(), response commit listeners to mark non-persistent connections, terminateRequestChannel() implementation, extra bytes buffer cleanup, and marking 417 responses as non-persistent. All authors are Red Hat developers (frainone@redhat.com, stuart.w.douglas@gmail.com), not TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.1.1.Final), NVD (< 2.1.1), cve.org (< 2.1.1.Final), Snyk (< 2.1.1.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-10719",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8952452f-4318-5759-ba61-a0a7d6c4509c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-10719 does not affect version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core. not_affected \u2014 CVE-2020-10719 affects Undertow \"versions before 2.1.1.Final\" per the advisory. The target version 2.2.28.Final is AFTER the fix threshold. The upstream fix (commit bfc8fbd67 by Red Hat engineers) is present in the target at core/src/main/java/io/undertow/conduits/ChunkReader.java:50,105-107, adding the LIMIT constant (Long.MAX_VALUE >> 4) and overflow check before chunk size accumulation. Git ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-1745",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:003e4cf8-b2ca-5626-ae3a-2045959e6a1f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-1745 does not affect version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core. CVE-2020-1745 (Ghostcat) is NOT present in Undertow 2.2.28.Final. The vulnerability involved the AJP connector blindly accepting arbitrary request attribute names, enabling file inclusion attacks. The upstream fix (UNDERTOW-1667, commit e60e04f4e) was committed on 2020-02-27 and released in version 2.0.30.Final on 2020-03-11. This fix was already present in the upstream release 2.2.28.Final when TuxCare onboarded it (first TuxCare commit f6212198e, 2026-09-24). The target code at AjpRequestParser.java:490-499 correctly validates all AJP request attributes against a known safe set (ATTR_SET), rejecting unknown attribute names by default unless they match an explicitly configured whitelist pattern (which defaults to null). The vulnerable code pattern (unconditional `state.attributes.put(state.currentAttribute, result)`) has been removed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.30), NVD (<= 2.0.29), cve.org (<= 2.0.29.Final), Snyk (< 2.0.30).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-1757",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4e1c3de3-4126-5f10-88c8-89a482eb16f6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-1757 affects version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2020-27782",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7b15eb78-a628-5a50-be12-0b97c7e0c705",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-27782 does not affect version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core. CVE-2020-27782 is NOT present in Undertow 2.2.28.Final. The vulnerability involved malicious query strings with non-RFC compliant characters sent via the AJP connector causing denial of service through unhandled IllegalArgumentException. Both required fixes (UNDERTOW-1404 and UNDERTOW-1824) were already present in the upstream 2.2.28.Final release before TuxCare onboarded it. The target code properly catches IllegalArgumentException during AJP query string parsing (AjpRequestParser.java:462) and implements proper AJP error response handling (AjpReadListener.java:259-265).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.1.0, < 2.1.5; < 2.0.33), NVD (= 2.0.33-sp2; = 2.1.5-sp1; = 2.2.3-sp1), cve.org (= 2.1.5.SP1; = 2.0.33.SP2; = 2.2.3.SP1), Snyk (< 2.0.33.Final; >= 2.1.0.Final, < 2.1.5.Final; >= 2.2.0.Final, < 2.2.3.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-20220",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:89b6874e-952a-5303-b5fe-c68639bb085f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-20220 does not affect version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core. not_affected \u2014 The target repository (Undertow 2.2.28.Final) is NOT vulnerable to CVE-2021-20220. The upstream vendor fix is already present in this version, having been authored by Red Hat engineers and shipped in the 2.2.28.Final release before TuxCare onboarded it. Both components of the fix are confirmed present: (1) HTTP/2 pseudo-header character validation in Http2ReceiveListener.checkRequestHeaders() t...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-3597",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:10a4ac8f-cf04-5dc8-9b92-f9f33323c4e6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-3597 does not affect version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core. not_affected \u2014 CVE-2021-3597 (UNDERTOW-1842) is NOT present in the target. The upstream fix for this vulnerability was already included in Undertow release 2.2.28.Final, which TuxCare onboarded on 2026-09-07. The fix commit (b92904715) was authored by Flavia Rainone from Red Hat on 2021-02-06 and is an ancestor of the TuxCare onboarding commit. The vulnerable code pattern - where flushComplete() would clear t...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-3629",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9d01578f-9d8f-5622-baaf-59f67ecd3bf9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-3629 does not affect version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core. not_affected \u2014 CVE-2021-3629 (UNDERTOW-1910) is not present in Undertow 2.2.28.Final. The vulnerability involved indefinite blocking in AbstractFramedStreamSinkChannel.awaitWritable() when HTTP/2 peers don't send WINDOW_UPDATE frames, causing denial of service via thread pool exhaustion. The fix (commit a4e7b1dbd) was authored by Red Hat and shipped in upstream release 2.2.28.Final, which TuxCare onboarded. T...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-3690",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:087af32b-e882-52b4-9aba-275563cea385",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-3690 does not affect version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core. CVE-2021-3690 (buffer leak on WebSocket PONG messages) is NOT present in Undertow 2.2.28.Final. The vulnerability affects Undertow before 2.0.40 and 2.2.10, and the target version 2.2.28.Final already contains the upstream fix (commit c7e84a0b7) that was shipped with the original 2.2.28.Final release. The fix adds proper buffer cleanup in FrameHandler.java lines 155-157 for PONG messages when no handler is registered.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.40; >= 2.2.0, < 2.2.10), NVD (< 2.0.40; >= 2.1.0, < 2.2.10), cve.org (< 2.2.10.Final; = 2.0.40.Final), Snyk (>= 2.2.0.Final, < 2.2.10.Final; < 2.0.40.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-3859",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b4c88373-4c8a-5c96-b550-23b666dc0a8a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-3859 does not affect version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core. Target version 2.2.28.Final is not affected by CVE-2021-3859. The vulnerability was fixed in upstream Undertow version 2.2.15.Final (per CVE affected version range \"< 2.2.15\"), and the fix commit e43f0ada3 is present in the target repository. The fix was part of the upstream 2.2.28.Final release that TuxCare onboarded, authored by rmartinc@redhat.com. The vulnerable HTTP/2 continuation frame handling pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.15), NVD (< 2.2.15), cve.org (< 2.2.15.Final), Snyk (>= 0, < 2.2.15.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-2053",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:da613f44-e11b-5c72-97ca-6e42875c6aa0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-2053 does not affect version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core. CVE-2022-2053 is NOT present in target version 2.2.28.Final. The vulnerability (AJP request exceeding max-post-size causes silent connection close, leading to proxy marking backend as error state and DoS) was fixed in upstream Undertow 2.2.19.Final. The fix commit (7d3a045da) added a specific catch block for RequestTooBigException that re-throws it before the generic exception handler can silently close the connection. This fix was already present in the upstream 2.2.28.Final release when TuxCare onboarded it on 2026-09-07. The fix author (jason@steeplesoft.com) and committer (frainone@redhat.com) are both upstream contributors, not TuxCare employees.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.19.Final; >= 2.3.0.Alpha1, < 2.3.0.Alpha2), NVD (< 2.2.19; = 2.3.0-alpha1), cve.org (= 2.2.19.Final; = 2.3.0.Alpha2), Snyk (< 2.2.19.Final; >= 2.3.0.Alpha1, < 2.3.0.Alpha2).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-4492",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:dc78dc6c-1048-576a-ab3b-373b261bb24d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-4492 does not affect version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core. CVE-2022-4492: The target version 2.2.28.Final is not affected. The vulnerability (missing hostname verification in HTTPS/HTTP2 client connections) was fixed in upstream Undertow commit a4d3b1671 (Dec 14, 2022) by rmartinc@redhat.com. This fix was backported to the 2.2.x branch via PR #1457 (merged Mar 30, 2023) and was already present in the upstream 2.2.28.Final release when TuxCare onboarded it (commit f6212198e). The fix enables endpoint identification algorithm \"HTTPS\" by default in both HttpClientProvider and Http2ClientProvider, ensuring server certificate hostname verification occurs during TLS handshake.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0, < 2.3.5.Final; < 2.2.24.Final), NVD (= 2.7.0), cve.org (= 2.7), Snyk (>= 0, < 2.2.24.Final; >= 2.3.0.Alpha1, < 2.3.5.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-1108",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:3e1887df-4d90-51a7-b6ca-143127806be3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-1108 does not affect version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core. The target repository is not affected by CVE-2023-1108. The vulnerability (infinite loop in SslConduit.wrapAndFlip during SSL handshake) has been fixed by the upstream vendor. The fix adds a check for engine.isInboundDone() to the while loop condition, preventing the loop from running indefinitely when the SSL engine's inbound stream is closed. This fix was introduced in upstream commit 1302c8cf4 by Red Hat on 2023-02-28, first released in Undertow 2.2.24.Final, and was already present when TuxCare onboarded version 2.2.28.Final.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.3.0, < 2.3.5.Final; < 2.2.24.Final), NVD (< 2.2.24; >= 2.3.0, < 2.3.5), Snyk (>= 2.2.22.Final, < 2.2.24.Final; >= 2.3.0, < 2.3.5.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-1973",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7b67ee0c-cb7e-5855-915d-d9a47294dba7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-1973 is fixed in version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2023-4639",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:725253a0-a83e-5db8-bd7e-229baa993272",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-4639 is fixed in version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2023-5379",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:87ae9a3d-be2a-54f4-a90a-ad1786850aa7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-5379 affects version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2024-1459",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5937dfde-a093-5ec2-bf5e-ea94bfe9fa3b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-1459 is fixed in version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2024-1635",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:94a65f5b-7890-568c-9f96-29aceb49306a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-1635 is fixed in version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2024-3653",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f34b39d3-a46b-5491-ba62-3cf2c94d25bd",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-3653 is fixed in version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2024-3884",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0aaba153-2d35-55c5-95b8-b3f123dd4671",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-3884 affects version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2024-4027",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8b6e270c-f25e-5549-9853-9ab9f7ebdacd",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-4027 is fixed in version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2024-4109",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ecc8a47d-00b0-5bc6-9f27-847bb7a94dad",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-core 2.2.28.Final-tuxcare.1."
      }
    },
    {
      "id": "CVE-2024-5971",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:fdec2678-f01f-531a-a077-754621614247",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-5971 is fixed in version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2024-6162",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:dc95180c-41ff-5fea-95a5-af8efa1130d5",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-6162 is fixed in version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2024-7885",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:32213830-0b19-51d2-9d3c-4b152ba8979f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-7885 is fixed in version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2025-12543",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0f1397bc-473f-564e-ba06-10062c4b3589",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-12543 is fixed in version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2025-9784",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e8844f50-9b44-5ce1-b9b0-3b28adc04ea3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-9784 affects version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2026-28367",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4a809a2c-99fb-5f7f-9425-8ed4b5aa4d84",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-28367 affects version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2026-28368",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f40c7f76-7edc-5a5c-ad52-bf4efde0ae9e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-28368 affects version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2026-28369",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:bf36547d-33d4-53b5-8be9-a5b6bef34439",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-28369 affects version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    },
    {
      "id": "CVE-2026-3260",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5e844b35-e855-5f24-9714-710e03b6b7b5",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-3260 is fixed in version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-core."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.undertow/undertow-core@2.2.28.Final-tuxcare.1"
    }
  ]
}